Medium severity6.5NVD Advisory· Published May 19, 2026· Updated May 20, 2026

CVE-2026-8706

Description

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox for iOSinferred2 versions
<151.0+ 1 more
- (no CPE)range: <151.0
- (no CPE)range: <151.0
Mozilla Corporation/Firefox
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*
Range: <151.0

Patches

Vulnerability mechanics

References

www.mozilla.org/security/advisories/mfsa2026-49/nvdVendor Advisory
bugzilla.mozilla.org/show_bug.cginvdPermissions Required

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000